SB2026093085 - Multiple vulnerabilities in nginx-ui

Description

This security bulletin contains information about 2 vulnerabilities.

1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to access management APIs.

The vulnerability exists due to incorrect authorization in the AuthRequired middleware when handling management HTTP requests. A remote user can present a valid WebSocket short token as an Authorization credential to access management APIs.

Routes protected by RequireSecureSession continue to require fresh OTP or passkey step-up for accounts with two-factor authentication enabled.

2) Insufficient Session Expiration (CVE-ID: N/A)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to retain access after ordinary logout.

The vulnerability exists due to insufficient session expiration in standalone short-token handling when renewing a valid short token after logout. A remote user can supply an arbitrary non-empty secure-session cookie to mint a fresh short token and retain access after ordinary logout.

Standalone short tokens have a 24-hour expiry unless renewed.

Remediation

Install update from vendor's website.

References

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-gp79-j356-rr7m
• https://github.com/0xJacky/nginx-ui/commit/1b022804ea20e99053f1a0514416c851f1f34d1d